When remote MCP Connect breaks, fix the 401 challenge before you chase Cursor or Claude UI. Unauthenticated probes must return 401 with a WWW-Authenticate header that exposes resource_metadata (your Protected Resource Metadata). Proxies, CDNs, and HTML error pages often strip that header — so login never opens, or tools never appear after login. Print this failure card into your runbook. Soft path: start at /free, then the MCP Starter Kit ($27) for the kit-backed layout; Cheat Sheet OK for the pocket checklist mindset.
This page is the standalone failure card—symptom → cause → fix. The end-to-end recipe (happy path, Cursor redirects, Claude `/mcp`, DCR vs static `CLIENT_ID`) lives on the companion pillar Build a remote MCP server with OAuth that Cursor and Claude can both Connect to. Use that when you need the full sequence; use this when Connect is already broken.
Symptom → cause → fix
| Symptom | Likely cause | Fix |
|---|---|---|
| Connect never opens a login UI | Middleware, CDN, or HTML error page stripping `WWW-Authenticate` | Hit the raw MCP URL; confirm the 401 still carries `resource_metadata` past every layer |
| 401 without `resource_metadata` | Incomplete challenge (PRM not advertised) | Publish Protected Resource Metadata and put its URL in the challenge before client settings |
| Login works, tools never load | Wrong audience / resource on the token vs your PRM resource identifier | Align resource binding on the AS; don’t rewrite Cursor/Claude configs first |
| Cursor works, Claude fails (or reverse) | Redirect URI, DCR, or static `CLIENT_ID` drift between clients | Prove the shared challenge first; then diff client redirects / DCR / static client—not two servers |
| DCR errors on every Connect | Authorization server doesn’t support Dynamic Client Registration | Ship a documented static `CLIENT_ID` path and test both clients on it |
| Intermittent 401 after a successful Connect | Clock skew, cookie/proxy caching, or a broken token refresh path | Inspector + server logs around refresh; bypass sticky HTML error pages |
| “Works in Postman” but not in Cursor/Claude | You’re sending API keys, not completing MCP OAuth | Happy path must start from the unauthenticated 401 challenge + PKCE browser grant |
One rule: if step “401 + `WWW-Authenticate` + `resource_metadata`” never happens cleanly, stop. Client UI trivia will not heal a stripped challenge.
Inspector debug tip / order
Use MCP Inspector against the remote URL (not only a localhost tunnel that rewrites headers):
- Probe without credentials.
- Confirm 401.
- Confirm `WWW-Authenticate` is present on that response.
- Confirm the challenge includes `resource_metadata` pointing at your PRM.
- Only then open Cursor Connect or Claude `/mcp` settings.
If the challenge dies behind a CDN or custom error HTML, fix the edge config (pass through `WWW-Authenticate`, don’t replace 401 with a branded page that drops auth headers). Re-test past every layer until Inspector and a raw `curl -i` agree.
Audience check after login: if the browser dance succeeds but tools stay empty, compare the PRM resource identifier to what the authorization server minted. Wrong audience looks like “auth worked”; it isn’t a missing Connect button.
Full dual-client recipe, redirect notes, and kit framing stay on the live MCP OAuth pillar. Pocket checklist companion: MCP auth checklist (PKCE, PRM, redirects) when that page is live.
What the MCP Starter Kit is for
The MCP Starter Kit ($27) is aimed at shipping remote MCP with Cursor and Claude Connect in mind—challenge, PRM, and client paths included—not only a local stdio hello-world. Soft path if you’re not buying yet: /free for the starter desk; Cheat Sheet for the skim failure-card / checklist mindset; kit when you want the auth-ready layout instead of stitching vendor posts.
Soft next step
Get the challenge right (401 + `WWW-Authenticate` + `resource_metadata`), then prove Connect in both Cursor and Claude. Soft ladder: /free for the starter desk, Cheat Sheet for the skim mindset, then the MCP Starter Kit ($27) when you want the auth-ready layout. No rush—ship this failure card into your own runbook either way. Deep recipe stays on MCP OAuth for Cursor and Claude Connect.